High severity · published Dec 2, 2024
CVE-2024-50380
Authentication Bypass by Spoofing in Snap One OVRC cloud
8.7
CVSS
0.5%
EPSS
No
On KEV
Description
Snap One OVRC cloud uses the MAC address as an identifier to provide information when requested. An attacker can impersonate other devices by supplying enumerated MAC addresses and receive sensitive information about the device.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OC
OVRC cloud · Snap One
before 7.3 · source: vendor
OR
Orvc · Snapone
before 7.3 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-50380
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-50380
www.cisa.gov
https://www.cisa.gov/news-events/ics-advisories/icsa-23-136-01
More from OVRC cloud
8.8
CVE-2024-50381
Missing Authentication for Critical Function in Snap One OVRC cloud